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(3) Arrangement for Implementing a visitor location register In a cellular mobile telecommunications 
switching ay atom. 



@ This Invention relates to apparatus and 
methods for providing cellular mobile telecom- 
munication service in accordance with the re- 
quirements of the Global Systems for Mobile 
Communications (GSM) standard. A modular 
switching system is provided which performs 
the functions of the mobile switching center 
(210) plus those of a home location register 
(212), authentication center (216), visitor loca- 
tion register (214), and equipment identity regis- 
ter (218). The latter functions are 
advantageously spread among the modules of 
the switching system, thus avoiding the getting 
started cost of expensive dedicated data bases. 
A wireless global switching module advan- 
tageously switches mobile communications 
control messages among the modules of the 
system and between the modules and the base 
station systems (204), and terminates signaling 
links between the mobile switching center and 
the base station systems. 
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Technical Ftold 



Thia invention relates to data base arrangements for cellular mobile telecommunications systems. 
5 Problem 



Mobile radio systems for permitting customers calling from mobile stations such as vehicular stations 
mounted In automobiles, portable stations of medium weight which may be transported readily, or smalt light- 
weight, hand held personal communication stations are becoming Increasingly prevalent Such systems use 

10 the principles of cellular technology to allow the same frequencies of a common allocated radio bandwidth to 
be reused in separated local areas or cells of a broader region. Each cell Is served by a base transceiver station 
comprising a group of local transceivers connected to a common antenna. The base station systems, each com- 
prising a controller and one or more transceiver stations are Interconnected via a switching system, a mobile 
switching center, which Is also connected to the public switched telephone network. Such cellular systems are 

15 now entering a second generation characterized by digital radio communications and a different set of stan- 
dards such as the European Global Systems for Mobile Communications (GSM) standard, promulgated by the 
Special Mobile Group (SMG). 

A major element of the mobile switching networks described in the GSM is a visitor location register (VLR). 
The VLR contains data for a mobile station including the last location area in which the mobile was found (for 

zo use In paging the mobile on a mobile terminating call or for delivery of queued messages), the directory number 
of the mobile, its permanent International Mobile Subscriber Identification (IMSI), and its Temporary Mobile 
Subscriber Identification (TMSI) for use in paging the mobile. In addition, it contains subscriber data describing 
services available to the subscriber. The visitor location register can be accessed using the roamer number, 
the TMSI, or the IMSI. The IMSI and the TMSI are used for finding a VLR record on calls originating from a 

25 mobile station, and the MSRN is used for finding a VLR record on calls terminating to that mobile station or 
on other services such as location update. 

The details of the implementation of the VLR have not been specified in the GSM standards. Implementing 
VLR as a data base accessible via a data network Is expensive, especially for small mobile telecommunications 
networks. Since the VLR is accessed frequently during the course of a mobile call, and since the accessing 

so of a data base over a data network is a relatively time-consuming process, a problem with this type of arrange- 
ment is that there Is considerable delay in setting up calls, and considerable use of data network resources in 
transmitting queries and responses between the mobile switching center and the VLR data base. Further, the 
present standards suggest that the VLR be updated whenever a customer moves from one location area to 
another, even when both location areas are served by the same mobfle switching center. Further, whenever 

39 this takes place, the TMSI for a mobile station Is changed which is another process requiring expenditure of 
MSC resources of a mobOe switching center serving that station. 

Further, the storage of VLR is wasteful since much of the data stored in the VLR duplicates data stored 
in the home location register (HLR) of a mobile telecommunications network, even when the mobile is in its 
home switching center area. 

40 Accordingly, a problem of the prior art Is that the suggested Implementation for visitor location registers 
(VLR) Is expensive especially for small mobile networks, causes delay In call set-up, and is wasteful in storage 
use. 

Solution 

45 

The above problems are solved and an advance is made over the prior art in accordance with the principles 
of this invention wherein the VLR of a mobile station Is stored In the mobBe switching center currently serving 
that station. This Is the basic VLR storage and not simply a temporary copy made to avoid unnecessary quer- 
ies. Advantageously, such an arrangement reduces the time required for making VLR queries and lowers the 

50 gettlng-started costs of a mobile telecommunications network. 

Because the VLR Is stored with a mobile switching center, It is not necessary to change the TMSI of the 
mobile unit when the mobile unit crosses location area boundaries, but continues to be served by the same 
mobile switching center. In effect, according to the principles of this Invention, the VLR Is tied to mobile switch- 
ing center and not to a location area. 

56 in accordance with another feature of this Invention, since the home location registerfor a particular mobile 
station is also stored in the home mobile switching center for that mobile station, whenever the mobile station 
Is in the region served by its home mobile switching center, the VLR and HLR are combined so that the common 
data is stored only once. Advantageously, this reduces the amount of data that must be stored for a mobile 
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station, whenever that mobBe station Is In Its home mobile switching center area. 

Brief Description of the Drawing 

5 FIO. 1 la a block diagram of the basic GSM model of a mobile switching center and Its direct and indirect 
interfaces; 

FIO. 2 illustrates how this model is implemented in one exemplary embodiment; 

FIG. 3 Illustrates the various signaling protocols used for signaling messages In mobile telecommunications 

systems; 

w FIG. 4 Illustrates the interconnections among mobile stations, land-based stations, base station systems, 
the public switched telephone network, and a mobile switching center, 
FIG. 5 illustrates the physical paths used for signaling and for voice or data Interconnections; 
FIGS. 6-8 illustrates the signaling interconnections Including the role of the wireless global switch module 
(WGSM); 

13 FIGS. 9-13 illustrate the process of establishing a mobile to land call; 
FIG. 14 Illustrates the release of a mobile call; 
FIGS. 15-18 illustrate the handover process; 

FIGS. 19-21 Illustrate the handover process In terms of message exchanges; 
FIGS. 22-28 illustrate an incoming call to a mobile station. 

20 

Detailed Description 

FIG. 1 is a block diagram of the reference model for the European standard, the Global Systems for Mobile 
Communications (GSM). Each of the lines interconnecting blocks of the diagram that is Identified with a letter, 
26 has a GSM standard specified interface. Briefly, the purpose of each of the blocks Is the following: 

The Home Location Register (HLR) 102 contains data for a mobile customer. The data stored In the HLR 
Is the permanent data that is independent of the customer's present location, plus temporary data such as 
the addresses of Service Centers which have stored short messages for a mobile station. (An example of such 
a message is a request to turn on a "voice message waiting" lamp indicating that a voice message has been 
30 stored for the mobile station user In a voice messaging system.) These addresses are erased after the short 
messages have been delivered. The HLR also indicates the Signaling System 7 point code used to find a mod- 
ule that contains the Visitor Location Register (VLR) 104 currently associated with the mobile station. 

The VLR contains current data for each mobile customer, including that customer's mobile station's present 
or most recently known location area, the station's on/off status, and security parameters. A remote VLR 108 
95 connected via a G Interface Is also shown. 

The authentication center (AUC) 108 provides authentication and encryption parameters to ensure that 
a mobile customer cannot falsely assume the Identity of another mobBe customer and provides data for en- 
cryption of the voice or data, and control signals transmitted via the air between the mobile station and a serv- 
ing BSS. The GSM reference model prescribes digital communication over the radio channels. Since it Is pos- 
40 slble to listen to these radio channels, encryption becomes desirable for the link between the mobOe station 
and the radio transceiver at a base station serving that mobile station. 

The Mobile Switching Center (MSC) 110 is for switching calls Involving at least one mobile station. 

The BSS 112 comprises a base station controller (BSC) 114 and one or more base transceiver stations 
(BTS) 116 for communicating with mobile stations (MS) 120. The BSS and the MS communicate via radio con- 
45 nections. The BSS is also connected via trunks to carry the voice or data, and control messages between the 
mobile stations and the MSC. The BSC and BTS may be In different physical locations (for example, the BSC 
may be co-located with the MSC) In which case a trunk is required to Interconnect the two. S m represents the 
human Interface to the MS. 

The equipment identity register (EIR) 124 retains a record of ranges of certified equipment identifications 
so and ranges of or Individual equipment Identifications which are under observation or barred from service. The 
equipment identification Information Is received from a mobile station at the mobile switching center. The EIR 
is used to verify that the equipment number of the MS Is certified for use In the public network and is not on 
the observation or service barred list 

Mobile switching centers are connected to other mobile switching centers, directly or via the public switch- 
55 ed telephone network 128, to the public switched telephone network for accessing land-based customer sta- 
tions and to integrated services digital network (ISDN) networks 126 for communicating according to the pro- 
tocols of ISDN. 

While the standards specify the functions of each of these blocks, they do not specify how each of these 
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blocks Is to be implemented. It Is the purpose of this description to Illustrate one arrangement for Implementing 
these standards in an advantageous manner. 

FIG. 2 illustrates the system architecture for Implementing a GSM mobile communication system. The mo- 
bile station (MS) 202 communicates with the BSS 204 over radio links 208 using optionally encrypted digital 

5 radio communications for the voice or data, and control connections between the MS and the BSS. Tne MS 
communicates via the BSS with the mobile switching center (MSC) 210. The BSS and MS exchange control 
messages with the mobile switch center using the CCITT signaling system 7 protocol (SS7). 

In this arrangement, the HLR 212, VLR 214, AUC 216 and EIR 218 records are all Integrated Into the MSC 
210. When an MSC needs the HLR, VLR, AUC or EIR records from another network entity, it obtains them 

w via SS7 messages transmitted to the entity that currently holds this information. 

The MSC communicates with a billing center 220 for accumulating Wiling records using the CCITT X.25 
protocol and also communicates with an Operations and Maintenance Center (OMC) 222 using the CCITTT 
X.25 protocols. The OMC communicates with BSSs via the MSC using SS7. In one Implementation, the OMC 
communicates with a customer administration system 224 using a standard RS-232 link. In addition, mainte- 

16 nance messages between the BSS and OMC are transmitted using SS7 with the Base Station System Oper- 
ation Maintenance and Administration Part (BSSOMAP) protocol. 

Signaling System 7 is described In detail In A. R. Modarressi et al.: "Signaling System No. 7: A Tutorial," 
IEEE Communications Magazine , July 1990, pages 19-36. The GSM standard protocols are specified In the 
GSM standard specifications, which at this time Is In version 3.8. 

20 FIG. 3 is a diagram of the protocols used in different types of communications, according to the GSM stan- 
dard. Most of these protocols are those of SS7. Of the seven layers of the protocol according to the Interna- 
tional Standards Organization (ISO) layered message protocol, only the top (application layer) and the bottom 
three layers (Network, Data and Physical) are shown on the left Four types of messages are shown; The first 
double column Includes those from switching system to switching system for land- based trunks Including either 

25 a telephone user part (TUP) or an ISDN user part (ISUP) (both SS7 standards) for the application layer. The 
second column Is for messages among MSCs. VLR, HLR and EIR which messages use the SS7 standard 
Transaction Capabilities (TC), Transaction Capabilities Application Part (TCAP) and Mobile Application Part 
(MAP) sublayers of the application layer (MAP la enhanced with GSM standards). When these messages are 
strictly Internal to the MSC, these protocols are simplified and messages transmitted directly or via protocol 

30 handlers between the responsible processors. The third column is for communications between the mobile 
switching center and a BSS. The final column is for communications between the mobile switching center and 
mobile station. 

The three bottom sublayers of the protocol (layer 1 , the physical layer, layer 2, the data layer, and sublayer 
3, the message transport part (MTP) sublayer, a sublayer of the network layer) are identical for all of these 

35 types of communications and are In accordance with the SS7 Message Transport Part (MTP) standards of 
the CCITT Q.701 - Q.707 standard. The Signaling Connection Control Part (SCCP), a sublayer of the network 
layer, also a CCITT standard Q.711-Q.714, is connection oriented for the MSC/MS communications, is con- 
nectionless for the second column, and may be either for the MSC/BSS communications. SCCP is available 
for some ISUP applications. For the first column (switch to switch) the TUP and ISUP application layer com- 

40 muntcates directly with MTP 3 sublayer of the network layer. 

Communications between the MSC and either the BSS or the mobile station use a Radio Subsystem (Base 
Station System) Application Part (BSSAP) protocol. For communications between the mobile switching center 
and the BSS, layer 7 uses the protocols of the BSSAP Including a Base Station System Management App^ 
cation Part (BSSMAP). The communications between the mobile switching center (MSC) and the mobile sta- 

45 tion are performed in the protocols of BSSAP including a Direct Transfer Application Part (DTAP). BSSAP, In- 
cluding BSSMAP and DTAP are GSM standards. 

FIG. 4 is a baste block diagram of a mobile switching center 400 (switch), as Implemented using AT&T's 
5ESS® Switch. The switch, described In detail In The AT&T Technical Journal , vol. 64, no. 6, part 2, July/August 
1985, pages 1305-1564, (Journal) Includes an administrative modue 402, a communication module 404, and 

so a group of switching modules 406-41 2. The switching modules applicable In t he GSM network are of four types; 
a wireless switching module (WSM) 408 for communicating with BSSs, and also optionally communicating with 
the public switched telephone network (PSTN); switching modules (SM) 408 for communicating with the PSTN; 
a wireless global switch module (WGSM) 410 for serving the signaling communication needs for controlling 
calls Involving mobile stations; and a PSTN Global Switch Module (PSTN GSM) 412 used if PSTN trunks are 

55 of ISUP or TUP types, I.e., use SS7 for signaling to the PSTN. The PSTN GSM processes ISUP or TUP pro- 
tocols and can optionally also be connected to PSTN trunks. 

The functions of the administrative module (AM), communications module (CM) and switching module 
(SM), In relation to the PSTN are essentially as described In the referenced Journal. The purpose of the WGSM, 
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as described hereinafter, Is to simplify the signaling communications between BSSs and the WSM serving 
calls for the BSS, and between the MS and the WSM. THe PSTN GSM Is for controlling common channel sig- 
naling between the MSG and the PSTN. The PSTN GSM Is connected by message delivery paths to protocol 
handlers In the SMs. 

s The signaling architecture of the mobile switching center is significantly simplified by having signaling mes- 
sages go through a common set of data switches and protocol handlers in a wireless global switching module 
(WGSM). Physically, the wireless global switching module Is connected via nailed up channels (message de- 
livery paths) switched through the time multiplexed switch of the communications module to each of the wire- 
less switching modules. These are 64 kilobit channels, the same as the PCM voice channels of the 5ESS switch 
10 communications module. Over another naDed up physical channel connecting the WGSM with a WSM mes- 
sages are sent for a BSS via virtual channels in that physical channel; other virtual channels of that physical 
channel carry messages that originate from or are destined for the mobile stations. 

The wireless switching modules (WSM) are combined packet and circuit switching modules each compris- 
ing a switching module processor (SMP), a packet switching unit (PSU) comprising a plurality of protocol Han- 
ts dlers interconnected by a local area network, and circuit switching arrangements Including a digital facility In- 
terface (DFI) and a time slot interchange unit (TSIU). The TSIU is connected to a time multiplexed switch of 
the communications module for Interconnecting the switching modules. Switching modules comprising a pack- 
et switching unit are disclosed in M. W. Beckner et al.: U.S. Patent 4,592,048. 

The signaling paths between the BSS, WSM, and the wireless global switching module (WGSM) are as 
20 follows. Each base station is connected by digital carrier facilities to two or more of the wireless switch modules 
504 (FIG. 5). Many of these digital facilities Include one or more signaling channels, the signaling channels 
from each BSS being connected to at least two WSMs. The signaling channel is connected via the digital in- 
terface of this wireless switch module 504 into the TSIU of the wireless switch module and is thereby connected 
through the communication module 508 and to a protocol handler (PH) In the wireless global switch module. 
25 The wireless global switch module protocol handlers are Interconnected via a local area network In the packet 
switch unit of the WGSM. 

The portion of the signaling path between the WGSM and a destination wireless switch module Is as fol- 
lows. The WGSM has at least one protocol handler with a portfor transmitting messages to and receiving mes- 
sages from a specific wireless switch module. This port Is connected to e message delivery path that passes 

so via a nailed up connection through a time multiplexed switch of the communications module. Each such mes- 
sage delivery path la a 64 klobit data link and Is connected to a port of a protocol handler at each end. In case 
of a failure of a protocol handler at either end, spare protocol handlers can be used to replace the failed protocol 
handlers. The protocol handler In the wireless switch module communicates on its local area network side via 
a packet interface with a switching module processor of the WSM. This switching module processor performs 

35 call processing and generates or processes, for example, the BSSAP portion of a message between a WSM 
and a BSS. The message delivery paths and the physical signaling data links Interconnecting a BSS and a 
wireless switch module carry a plurality of virtual data paths, usually, temporary virtual data paths (SCCP con- 
nections) associated either with a mobile call or a mobile service such as a location update. 

These signaling arrangements have a number of advantages. By having at least two signaling data links 

40 between each base station and at least two wireless switch modules, redundancy is gained and operation can 
continue even if either of the signaling channels (Including the protocol handlers at each end of a signaling 
channel) or a WSM fells. The use of a single wireless global switch module with Inherent sparing of protocol 
handlers concentrates the translation Information required to select a destination wireless switch module when, 
for example, VLR data for a particular customer, as Identified by that customer's International Mobile Subscrib- 

45 er Identification (IMSI) Is required. Failure of one or more of the protocol handlers In the WGSM can be over- 
come by replacing a failed protocol handler with a working spare and by properly Initializing that protocol han- 
dler to take over the functions of a failed protocol handler. Local reference numbers, discussed hereinafter are 
used to Identify SCCP connections. As described hereinafter, because key information Is stored In the local 
reference numbers, and because duplicate records are maintained on all stable SCCP connections through 

so protocol handlers of the WGSM. none of these connections are lost even though they may have been served 
by a failed protocol handler. 

The WGSM has at least one spare protocol handler per shelf of a PSU. In the event of a faflure of any 
protocol handler, a spare takes its place. If no redundant data were available, then In the event of a simplex 
faflure In a protocol handler the dynamic data regarding SCCP connections would be lost and consequently 

55 all BSSAP calls switched through that protocol handler would be lost Redundancy of this data is added to the 
software architecture to ensure the integrity of this connection data. 

When a connection is set up between e mobile switching center and a BSS, a local connection identifier 
is associated with each distinct connection. In order to keep each Instance of the connection coordinated be- 
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tween the MSC and the BSS, this connection InformaUon Is shared through the use of SCCP local reference 
numbers. According to the CCITT SS7 protocol, each end will send Its local reference number and the far en<f s 
local reference number when first confirming the setup of a valid connection. Subsequent dialog requires the 
sending of the tax end's local reference number. The value of this local reference number Is not constricted by 
5 standards. When a connection Is first initiated in the mobBe switching center, the local reference number Is 
encoded to Include a connection Identifier and the number of the protocol handler on which the connection 
resides. 

The MTP layer provides for load sharing on a data link, changeover and changeback, with the possible 
result that Incoming messages for a connection may arrive on a different physical link than messages being 

10 sent When this occurs, the SCCP message arriving in a different protocol handler is routed to the proper pro- 
tocol handler by decoding the local reference number since that quantity contains the Identification of the pro- 
tocol handler (PH) upon which the connection resides. 

Whenever a SCCP connection goes Into an active (stable) state, this connection Information Is shared 
with the next ascending PH in the PSU community (wherein the first PH Is the "next ascending" PH for the 

is last PH). This "next ascending" PH is known as a "backup PH." When a PH falls, a spare PH is switched into 
Its position and thereby connected to the sources and destinations of messages for that PH. Trie "next as- 
cending" PH transmits to the spare PH a list of reference numbers of stable connections from the failed PH; 
the "next ascending" PH will continue to control these connections as long as they are active. The spare PH 
assigns local reference numbers for new connections that have the same logical PH number as the connec- 

20 tions formerly served by the failed PH. When the spare PH receives a message for an active connection. It 
first checks to see whether the reference number Is one of a connection controlled by the "next ascending" 
PH. If so, the spare PH transmits that message to the "next ascending" PH which has the information for proc- 
essing that message, and which therefore can maintain the virtual connection. In this way In the event that a 
PH falls, messages received on existing SCCP connections for the failed PH are automatically routed to the 

26 "next ascending" or backup PH. When a PH falls, the backup PH will automatically restart timers associated 
with the SCCP connections from this backup Information. In this way, stable connections wDI remain stable 
as will calls dependent on those connections. Every PH, that sets up SCCP connections, has a dedicated back- 
up PH. Since a spare PH then assumes the logical role and name of the failed PH and accepts new SCCP 
message connection requests for that PH, this will gradually reduce the temporary overload on the backup 

so PH. When the faBed PH Is eventually restored to service, It then takes the role of a spare PH. 

While In this embodiment, the "next ascending" PH Is used as a backup, any other predetermined backup 
arrangement, such as the "next ascending skipping 1 " (In a system with an even number of active PHs) could 
be used Instead. The term "predetermined adjacent" is used to describe any predetermined backup PH selec- 
tion. 

35 As discussed above, when the spare PH assumes the role of the failed PH, the backup PH wBI report the 
present status of all Its active connections to the spare PH. The spare PH will not reuse resources, such as 
connection Identifier numbers, for active connections still running on the backup PH when setting up new 
SCCP connections. The backup PH will then continue to service all presently active connections until they 
are released, as well as servicing new SCCP connections for Itself. 

40 When a mobBe station is first powered up within a specified mobile network, the international mobDe sub- 
scriber identification (IMS!) Is used by the mobile station to identify Itself. This IMSI is used to route a request 
for VLR data to the WSM that contains that data. Each protocol handler of the WGSM contains a table that 
stores the IMSI-WSM map, the table being created from data supplied by the WSMs. In order to allow HLR 
and, where possible, associated VLR records to be stored in any WSM, this look-up table has one entry per 

45 IMSI. During the location update or registration process, the SM that stores the VLR data wll associate a Tem- 
porary Mobile Subscriber Identification (TMSI) with a mobile station. The TMSI, whose value, while at least in 
part random, Is not otherwise constricted according to the GSM standard, is specially encoded with the identity 
of the WSM (i.e., a switching module having wireless software) that contains the VLR so that accessing the 
proper WSM for Incoming messages when VLR data is required Is simplified If the TMSI is available. Random- 

» ness of the TMSI is maintained by randomizing three of Its four octets. Except on Initial mobile station power 
up, as described above, the TMSI will normally be used for all BSSAP transactions. When a mobile station 
initiates a transaction (such as a call or location update), the SCCP connection data base that stores Infor- 
mation about the transaction, also stores Information to Identify the WSM that contains VLR data as well as 
the WSM that contains the trunk connected to the BSS. This Is used for the routing of all subsequent messages 

55 for this connection, which contain no TMSI. 

As an example of the operation of the signaling system, consider a data connection between a BSS and 
a mobile switching center. Assume that the connection Is Initiated In the BSS. An Initial message would first 
be transported by MTP In the BSS from the BSS over a signaling data link logically Interconnecting the BSS 
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and a WGSM. The protocol handler, In the wireless global switch module, which terminates the signaling data 
link passes the message from MTP to a SCCP control program. This SCCP program strips off the MTP header 
and parses the message. Depending on the contents of the message, a connection is established or released, 
or the transfer of data Is required. In this example, connection establishment Is requested and a SCCP corv 

5 nectlon (I.e., a virtual circuit) is temporarily set up between the protocol handler In the WGSM end of the sig- 
naling data link and the protocol handler In the BSS. The SCCP control program Informs a base station system 
application part (BSSAP) (also referred to as a radio subsystem application part In FIG. 3) of the request for 
a connection establishment via a primitive Interface. BSSAP then parses the BSSAP message and obtains 
the Identity of the destination wireless switch module. In the case, for example, of a query requiring VLR data, 

to this destination WSM Is identified by the International mobile subscriber Identity (IMSI) field contained in the 
BSSAP message. The BSSAP control process uses the IMSI to Index a look-up table to find the WSM where 
tha VLR data base for this IMSI Is to be found. The message Is then sent within the WGSM from the protocol 
handler terminating the signaling data link to a protocol handler that terminates a message delivery path to 
the identified WSM. This protocol handler then sends the message to a protocol handler on the destination 

18 WSM which in turn forwards the message to the switching module processor of that WSM. A BSSAP control 
process In the destination WSM then further parses the message and passes it on to a call processing program 
for processing a mobile call or service. 

Another example of the signaling procedures carried out In this embodiment of the invention is the pro- 
cedure for sending a message from a wireless switch module to a BSS via an established connection. In the 

20 transmitting wireless switch module, a BSSAP process assembles a BSSAP layer of the message that Is tag- 
ged with the local reference number Identifying the SCCP connection. This process then forwards the mes- 
sage to a protocol handler in the source wireless switch module, which then transmits the message over a 
nailed up message delivery path going through the communications module to a first protocol handler In the 
wireless global switch module. This first protocol handler examines the local reference number of the message 

25 and uses this to determine the second protocol handler that terminates the SCCP connection. (This local ref- 
erence number was previously derived during the process of establishing the SCCP connection.) This protocol 
handler then uses a SCCP process to encapsulate the message with a SCCP header and passes the message 
to a message transport part (MTP) process for adding the MTP headers. The message Is then sent over the 
(logical) data link to the BSS. (The physical data link corresponding to this logical data link has been described 

30 earlier.) 

Advantageously, this type of arrangement permits essentially all of the SS7 protocol handling functions 
to be carried out In the packet switching unit of the WGSM (without Involving the switching module processor 
of the WGSM) and allows the transmitting and receiving WSMs to process their messages Independent of the 
destination. Effectively, the set of protocol handlers of the packet switch unit of the WGSM acts as the handler 

35 of all signaling protocols. (A maximally equipped WGSM contains 75 active and 5 spare protocol handlers.) 
The WGSM assembles and disassembles the Signaling System 7 headers to the application data of the mes- 
sages and switches the messages for transmission to the proper WSM which may either accept the messages 
(if the destination is the mobfle switching center) or originates messages to the appropriate BSS (if the des- 
tination Is either a BSS or a mobile station). 

40 In addition, the MSC communicates from the administrative module with an external service center 224, 
using the X.25 protocol for delivery of short messages, such as an Indication of a voice message waiting. The 
MSC communicates with the public switched telephone network using a land-based signaling system such as 
SS7. 

The switching modules also communicate messages via the message switch of the communication module 
45 as is done In a land-based 5ESS switch. Call processing messages, such as the messages that are exchanged 
In order to eet up a connection through the communications module between, for example, a switching module 
connected to the public switched telephone network portion of a land-to-moblle or mobile-to-land call and the 
wireless switching module that is connected via the BSS to the mobile station end of the call, are sent In this 
way. 

so Whenever an MS la In the region served by its home MSC, I.e., the MSC that contains the HLR for that 
MS, the base VLR is attached to the HLR In such a way that common data Is stored only once for the two 
registers; the VLR and HLR are then stored in the same module. 

When the mobile station Is either in the power-off state or In the power-on state but not In any active call 
state, only a base version of the VLR Is maintained for that mobile station In the VLR WSM. When a call is 

55 originated by a mobile station or a call Is received for that mobile station, a separate dynamic version of part 
of the VLR Is stored and maintained in the WSM that controls the mobile calls. This copy of the VLR Is linked 
to the terminal process In that WSM that controls the mobile station end of the call, rf the mobfle station moves 
and the call Is handed over to e different switching module, then the dynamic copy of the VLR Is transferred 
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to the new WSM serving the mobile station for that call and Is linked to a terminal process for serving that call 
in that WSM. Note that the data In the base VLR that is not relevant to the MS locations Is changed only by 
administrative actions or such customer programming actions as the specification of a call forwarding number 
and are not copied Into the dynamic VLR. When necessary, the system administrator modifies the HLR which 

5 in turn updates the base VLR; the administrator has "read only" access to the base VLR for trouble shooting 
purposes. 

The location of the mobile station is not updated in either the dynamic or the base VLR dunng a call, and 
is updated In the base VLR only as part of a location update procedure. Location update procedures are carried 
out when the mobile station is Idle with power on, and moves from one location area to another. A location 

10 area is the area that Is paged when a call terminating to an MS is received. 

Ail Incoming calls first check the HLR. Tills is because the HLR is fixed and the location of the HLR record 
is tied to the called number (directory number) of a mobile station. The HLR has stored within It the Information 
necessary to find the base VLR; this Information Includes an Identification of the mobile switching center that 
contains the base VLR For this detailed description, this MSC Is the same as the MSC of the HLR, and the 

15 HLR and VLR are stored as one block so that If either is located the other Is also located. All administrative 
changes of data associated with a mobile station are entered first Into the HLR which then sends messages 
for entering the corresponding change In the base VLR. Customer Initiated changes such as the prescription 
of a different call forwarding number are forwarded Initially to the base VLR which does not initially make any 
change in its record but forwards the request to the HLR which makes the necessary change and generates 

20 a message for updating the base VLR. The HLR is accessible via the mobile station directory number or the 
International Mobile Subscriber Identification (IMSI). The VLR is accessible via the IMSI or the TMSI; the HLR 
can also access the VLR by a special ISDN address. ISDN addresses are maintained for VLRs, pHLRs, MSCs, 
and EIRs according to the GSM specification. 

The VLR is attached to the HLR so that common data need only be stored once. This arrangement is sat- 

25 isfactory as long as the mooDe station is In the region served by the MSC; consideration of the storage of the 
VLR when the mobile station leaves that region is beyond the scope of this description. 

The combined HLR and VLR Is stored In the wireless switching modules of the MSC. Each switching mod- 
ule stores records for a range of mobile directory numbers and each module has a range translation to select 
a module based on the directory number. Since the HLR/VLR must also be accessible via the IMSI, a table is 

30 stored In each protocol handler of the WQSM to Identify the module that has stored the VLR/HLR for each 
IMSI served by the MSC. No translation Is required for access via the TMSI since that contains a subfleld for 
Identifying the VLR/HLR modules. 

FIG. 5 Is a block diagram illustrating the physical signaling paths between base stations and wireless 
switching modules. The base stations 502 are connected through permanent virtual circuits which physically 

6 pass through a WSM 504 serving the base station and through the communications module 508 to a protocol 
handler In the WGSM 508. The protocol handler receives messages in the SS7 protocol used to communicate 
with the base station and transmits the message to the correct WSM; the digital facDity Interface connected 
to the BSS transmits the messages to a protocol handler of the WGSM which is connected by a swltchable 
physical nafled up data channel to the destination WSM, where It terminates on a protocol handler which Is 

40 connected to the switching module processor of the WSM. Advantageously, the WGSM terminates a standard 
protocol and allows any WSM to control any calls from the base stations that have trunks to the WSM, since 
the processor of the switching module (SMP) for controlling the call need not be the SMP for controlling a spe- 
cific connection between a BSS trunk and a channel to a CM or to another output of the WSM. 

FIG. 6 shows the logical signaling system. The base station system 802 communicates with the WGSM 

45 604 which then delivers Its message via the communications module 508 to the appropriate WSM 610. 

As shown In FIG. 7, the VLR data for a particular mobile switching center Is spread out over the WSMs 

702 704 In that center. In the particular example, when WSM 702 needs VLR Information from WSM 704, 

it requests the information via the call processing Inter-module data links switched through the message switch 
of the communications modules of the 6ESS switch. 

so FIG. 8 illustrates the modules Involved in a mobDe-to-land call. The base station system 602 nearest the 
mobile is connected by a voice path to a wireless switching module (WSM) 804 which is connectable through 
the communication module (CM) to another switching module for connection via the public switched telephone 
network (PSTN) 808 to the called customer. The PSTN global switching module (GSM) 810 is used for con- 
trolling SS7 signaling to the public switched telephone network. The WSM 812 that contains the base VLR 

55 data is connected via virtual data links to the WSM 804 controlling the mobile station leg of the call. The SM 
806 and WSM 804 are connected by a virtual data link In order to coordinate the activities of the terminal proc- 
ess handling the call In each of these modules. The WGSM 814 communicates all data to and from the BSS 
and transmits It as necessary to either the WSM 804 or the VLR-WSM 812. 
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Consistent with the principles of operation of the 5ESS switch for land- based calls, the administrative mod- 
ule 508 (FIG. 5) Is used for selecting outgoing PSTN trunks on mobile originated calls and for selecting time 
slots for voice paths between switching modules. In addition, the administrative module is used for selecting 
a trunk between the mobile switching center and a base station controller. The base station controller selects 

5 a path between the incoming trunk to the base station controller and the base transceiver station. As previously 
Indicated, this path may be a land-based trunk. The trunks between the BSSs and the mobile switching center 
are one way outgoing from the mobfie switching center. This makes the finding of an idle trunk from the cen- 
tralized administrative module efficient and allows the trunks to be fully utilized: whether the call is originated 
by a mobile station or Is terminated to a mobile station, the trunk will be hunted for and allocated by the ad- 

10 mlnistrative module which is a part of the mobile switching center. 

FIGS. 9-13 Illustrate the messages required In processing a mobile-to-land call and shows the source and 
destination of each message. The call is Initiated by a control channel request message 902 (FIG. 9) from the 
MS to the BSS to request the assignment of a dedicated control channel for further signaling from the MS. 
The BSS responds with a control channel assignment message 904 to allow the MS to access the proper cen- 
ts troi channel. The MS then transmits a service request message 908 to the BSS which passes this service re- 
quest message 908 to the WGSM. The WGSM transmits a process access request message 910 to the WSM 
that contains the VLR information. The WGSM has the data for determining which WSM contains the VLR 
information for this mobile station. This data is used when the TMSI is not available, ff the TMSI is avaflable, 
it has the VLR-WSM ID encoded in it for easy Identification of the VLR-WSM. The message from the WGSM 

20 to the VLR-WSM is for processing the service request and for creating the connection data in the VLR-WSM 
for the request The VLR-WSM enters a tuple In the connection data block for the process that handles the 
request The data Includes the identification of the connection transaction using the connection. An authen- 
tication process, If needed, Is Initiated by the VLR-WSM, which transmits a message 1002 (FIG. 10) to the 
mobDe station (the message Is actually transmitted via the WGSM, the WSM connected to the BSS, and the 

25 BSS) to request authentication algorithm calculation. The mobile station responds to the VLR-WSM with a 
message 1004 containing the result of the authentication algorithm calculation. 

Meanwhile, the VLR-WSM transmits a message 1006 to the administrative module (AM) requesting the 
assignment of a BSS trunk for the call and the AM transmits a message 1008 to the WSM connected to that 
trunk for creating a wireless originating terminal process In that WSM for handling the call. The WSM then 

30 returns a message 1 01 0 to the VLR-WSM for notifying the VLR-WSM which trunk WSM (i.e., WSM connected 
to the trunk to the BSS serving the caB) and BSS trunk has been assigned to the call. As will be seen below, 
the VLR-WSM is required for controlling the ciphering information for the call. 

If ciphering is used, the VLR-WSM transfers (message 1102, FIG. 11) to the WSM for handling the call, a 
copy of the call processing related information, relating to the mobile station from the VLR record to the call 

35 controlling WSM. If ciphering is used, the VLR-WSM transfers the cipher command to the BSS via the WGSM 
(messages 1104 and 1106). The BSS transmits a cipher mode command (message 1108) to the mobile station. 
The mobile station then sets up the cipher mode and transmits back to the BSS, a cipher mode completed 
message 1 11 0. The BSS sends a message to the VLR-WSM that the cipher process has been completed 1112. 
At this time, both the BSS and the mobile station are In a corresponding cipher mode. The details of the en- 

40 cipherment are specified In the GSM standard. 

The mobfle station then sends a setup request message (1114 and 1116) via the WGSM to the call con- 
trolling WSM (l.e. ( the WSM that contains the terminal process for the mobile station). The WGSM had previ- 
ously been Informed of the Identity of the WSM In message 1104. The WGSM checks to ensure that no failures 
have been encountered up to this time before call setup request If any failures have occurred, the failures are 

45 reported to the WSM. The WSM then transmits a message 1118 to the mobile station indicating that the call 
Is proceeding. 

Next, if the equipment validation function is nailed, the VLR-WSM in cooperation with the call controlling 
WSM and the mobile station performs that function. (Equipment validation is optional In GSM according to 
the wishes of the telecommunications operator.) The VLR-WSM requests (message 1202) the mobile station 

so to furnish Its International Mobile Equipment Identification (IMEI). The mobile station responds with its IMEI 
(message 1204) to the VLR-WSM which checks to insure that the mobBe station Is authorized to use the net- 
work. The VLR-WSM sends the result of its check (message 1206) to the call controlling WSM. Meanwhile 
the trunk WSM notifies the BSS of the identity of the previously assigned BSS trunk (message 1208). The 
WSM also requests that the BSS pick a radio channel for the voice (or data) communication with the mobile 

65 station. This radio channel will then be associated with the assigned BSS trunk for the length of the ceil or 
untQ the call is handed over to another BSS or terminated. The BSS assigns the radio channel and notifies 
the mobile station of the assignment (message 1210). The mobBe station responds (message 1212) when it 
has received this assignment and has tuned its radio to that channel. The BSS then reports back to the WSM 
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that the radio channel assignment process and the radio to trunk connection have been completed (message 
1214). The WSM requests (message 1 21 6) the administrative module to hunt for a trunk to t he public switched 
telephone network for completing the land part of the call and the administrative module assigns this trunk 
and requests the switching module connected to that Into create a terminal process for the call (message 1218). 

5 The switching module then transmits a message 1220 to the WSM thai the network connection Is proceeding 
and transmits a message 1222 to the PSTN GSM which transmits message 1224 to the public switched tele- 
phone network to set up the call. (This is a TUP or ISUP message depending on the type of trunk signaling 
used to access the next switching system of the PSTN.) 

The public switched telephone network then responds to the SM with a message 1302 (FIG. 13) indicating 

10 that the called customer is being alerted and the SM transmits a message 1304 to the WSM which sends a 
message 1 308 to the mobBe station to connect alerting tone. (This Is supplied locally within the mobile station.) 

Sometime later, the public switched telephone network sends message 1308 to the SM that the called 
customer has answered. The SM sends a message 1310 to the call control WSM to Indicate that an end-to- 
end talking path has been established. The call control WSM so informs the mobile station (message 1312). 

13 The mobile station responds with an acknowledgment (message 1 314) and the call is now active. 

Next the disconnect process wBI be discussed (FIG. 14). It will be assumed that the mobile disconnects 
first The mobile sends a disconnect message 1402 to the WSM whose terminal process is controlling the mo- 
bile end of the call and the WSM transmits a release message 1 404 to the mobile and a network release request 
1405 to the SM connected to the public switched telephone network. The mobile then transmits a release com- 

20 plete message 1408 to the WSM. The SM releases the call and transmits a network release message 1410 
to the public switched telephone network. The SM also transmits a message 1412 to the administrative module 
to release the trunk to the PSTN and the WSM sends messages 1414 to administrative module for releasing 
the BSS trunk and 1416 for making a billing record of the call If necessary. (Several billing records are sent 
in one message so that not every call generates a faming message from an SM to the AM.) The WSM also sends 

25 a release message 141B to the VLR-WSM to update the status of the mobile station of the call. The VLR-WSM 
sends a dear command 1420 to the WGSM for clearing the connection Information for messages if the call 
is the last transaction for the mobile station. (If other transactions, such as the delivery of a message waiting 
signal message, are required, the connection is kept up; the VLR remains Involved In call control, but not the 
WSM attached to the BSS for controlling the call.) The WGSM sends a clear command to the BSS to release 

30 the radio channel and receives an acknowledgment 1424 from the BSS that the radio channel has been re- 
leased. The BSS sends a dear command 1426 to the mobile station to release the transmitting channel. The 
WGSM then sends a dear complete message 1428 to the VLR-WSM to confirm that the mobile station is now 
released. 

The handover procedure will now be described. Since a mobile station may travel during the course of a 

36 call, it could easily get outside the effective range of the base transceiver stations of one BSS and into the 
effective range of another. Under these circumstances, It Is Important that the mobile station be retuned to a 
frequency of a transceiver of the second BSS and that the call be continued via that transceiver. The process 
will first be described in terms of the connections, then in terms of the message exchanges. 

FIGS. 15-18 illustrate the process of a handover to a base transceiver station in another BSS served by 

40 the same MSC. The request is originally made from the BSS 1502 serving the call in response to a message 
from the mobile station 1504 reporting the signal strengths of the serving base transceiver station and nearby 
candidate base transceiver stations. At this time the call is served from BSS 1 502 and wireless switching mod- 
ule 1506. The wireless switch module 1506 selects a new base transceiver station which Is, In this example, 
on a new BSS 1 51 0. The administrative module selects a trunk 1 512 (FIG. 1 6) between wireless switching mod- 

45 ule 1512 and BSS 1510. The administrative module also selects a network time slot 1532 between the switch- 
ing module 1 530 (the pivot module) connected to the land-based station via the public switched telephone net- 
work 1540 and the wireless switching module 1520. BSS 1502 then sends a message to the mobile station 
to retune to the transceiver system of BSS 1510. At the completion of retune (FIG. 17), the connection through 
the time slot Interchange In the pivot module Is switched to the connection 1532 to wireless switch module 

so 1520. At this point, the land-based station Is connected through the public switched telephone network 1540, 
through pivot switch module 1530, and through WSM 1520 and BSS 1510 to the mobBe station 1504. Finally, 
the old resources, namely the connection 1542 between the pivot module 1530 and WSM 1506 as weP as the 
connection between WSM 1508 and BSS 1502 are released as are the radio resources for the call in BSS 
1502 (FIG. 18). 

55 The handover process wB I now be described (FIGS. 19-21) In terms of the appropriate message exchang- 
es. According to the standards discussed previously, a mobile station performs the task of measuring the 
strength of signals received from different BSSs in Its vldnity. The mobBe station periodically sends the meas- 
urements message 1902 (FIG. 19) to the base station currently serving that station. If the BSS detects that 
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the signal from the BSS currently serving that mobBe station Is below the threshold of signal strength required 
for reliable communications, the BSS sends a message 1904 to the WGSM of the mobile switching center In- 
cluding an ordered set of candidate base transceiver stations for handling the call further. The WGSM delivers 
the message 1904 to the WSM currently handling the call (the old W3M), Indicating that a handover Is required 

5 and passing the list of candidate base transceiver stations. The old WSM after consulting the terminal process 
for the mobile station to determine that handover may proceed, passes this Information via message 1906 to 
the administrative module for the allocation of a trunk to the first candidate BSS. The administrative module 
transmits a message 1908 to the WSM connected to the selected trunk of the BSS (the new WSM) and the 
new WSM transmits a message 1910 to the switching module connected to the land path (the pivot SM) to 

10 set up e second time slot path for use with the new connection from the public switched telephone network 
to the new WSM, and to inform the pivot SM of the new WSM and new terminal process Identity. The new 
WSM sends a message 1912 to the old WSM Indicating that the new path setup is complete and the old WSM 
transfers the copy (message 1914) of the VLR Information which it has stored associated with the terminal 
process for this call to the new WSM. The new WSM then sends a handover request message 1916 to the 

15 new BSS for assigning a channel in the new BSS, and the new BSS returns an acknowledgment 1918. The 
handover request acknowledgment Includes the frequency and channel which the new BSS will use to com- 
municate with the mobile station. 

The new WSM sende to the old WSM a handover request acknowledgment 2002 (FIG. 20) which Includes 
the Identification of the new frequency and channel to which the mobHe station Is to be tuned. The old WSM 

20 transfers that call's specific data to the new WSM via message 2004 and defers processing of all messages 
to and from the MS that are being sent to the old WSM. Such messages will subsequently be forwarded to 
the new WSM. The new WSM returns a message 2006 Indicating that the call'e specific data transfer has been 
completed, and the old WSM transmits message 2008 to the VLR-WSM, Indicating that the actual channel 
switching is about to start and requesting the VLR-WSM to defer the processing of new Input signals. (Exanv 

25 pies of new input signals whose processing Is deferred during handover are short message delivery requests, 
e.g. a request to deliver a turn on voice message waiting lamp - short message, or new calls to the mobile 
station.) The old WSM then transmits a handover command 201 0 to the old BSS, which forwards that handover 
command 2012 to the mobile etatlon. In response to this handover command, the mobile station tunes to the 
new assigned frequency and channel for communicating with the new BSS. The mobile station then transmits 

30 a handover access message 2014 to the new BSS which transmits a message ("use physical channel" mes- 
sage 2016) requesting the mobile station to establish frame synchronization with the base station physical 
channel. The mobile station transmits a handover detect message 2018, Indicating that a physical layer con- 
nection has been established to the new BSS, and that the mobile station has retuned. The new BSS transmits 
a message 2020 to the new WSM that the handover has been detected, which, In response to that message, 

35 requests the pivot SM to switch to the new path (message 2022). The pivot SM switches to the new path and 
transmits an acknowledge message 2024 to the new WSM. 

After the layer 3 protocol is established, the mobile station sends a handover completion In message 21 00 
(FIG. 21) to the new BSS which forwards the message 2102 to the new WSM. The new WSM then transmits 
to the old WSM a message 2102 (FIG. 21) that the handover has been completed and the old WSM transmits 

ao a message 2104 to the VLR-WSM that the handover has been completed; this message Includes the Identity 
of the new WSM. The old WSM transmits to the new WSM any queued messages 2106 for this mobBe station 
and the new WSM acknowledges the end of this message transfer (message 2108). The old WSM transmits 
a message 2110 to Inform the pivot SM to release the old path. The old WSM also transmits a message 2112 
to the administrative module to release the old time slot. In the meantime, the VLR-WSM, In response to the 

45 receipt of the handover end message 2104, transmits message 2114 to the old BSS to release the old radio 
channel, and the old BSS releases this channel and transmits an acknowledgement 2116 to the VLR-WSM. 

In the transitional stages, the new WSM is connected to the pivot SM but the path Is not continued through 
the time slot Interchanger of that SM for connection to the far party. This connection Is made after the mobile 
station has tuned to the radio frequency of the new BSS, and is made at the same time as the old time-slot 

50 Interchange connection for connecting the current WSM to the public switched telephone network. Is dropped. 
Thus, only one connection is made through the SM connected to the far party and that connection Is made 
through the time-slot interchange of that switching module. This permits a very rapid transition from one con- 
nection to another, since all other connections are made before the time-slot Interchange connection is switch- 
ed. 

55 As long as a mobile switching center continues to serve a particular mobile station, the VLR for that mobile 
station Is maintained in that mobile switching center and Is retained In the same switching module of that mobile 
switching center even ae the mobile moves to different areas served by that switching center. (The procedures 
for handing over a mobile station from one mobile switching center to another are beyond the scope of this 
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Detailed Description.) Since the switching module which contains the call data for serving a call for a particular 
mobBe station, retains the bulk of the Information from the VLR, and further retains the Identity of the switching 
module that contains the base copy of the VLR, there Is no need to move that base copy even when a mobile 
moves and is subsequently served by e different wireless switching module. 

9 A land-to-moblle call will now be described. An incoming call message 2202 (FIG. 22) Is received from the 
public switched telephone network at the mobile switching center. (Note that the land-to-mobile call could also 
originate in the moble switching center.) Forthe case of SS7 signaling on the incoming side, the mobile switch- 
ing center sends an address complete message 2204 to the public switched telephone network. The MSC 
which received the Incoming call Is the MSC that, on the basis of the telephone number, Is the 'home" for this 

10 mobile station. (The procedure for handling cane with base HLR information in another MSC is beyond the 
scope of this Detafled Description.) This MSC contains the base HLR Information for the mobile unit. 

The MSC consults the HLR forthat mobile unit In the appropriate wireless switching module (action 2208), 
and obtains Information as to which MSC Is currently serving the mobBe unit (action 2208). If the mobile unit 
Is currently roaming and outside the range of the home MSC, the MSC reroutes the call to the MSC that serves 
is the mobie unit In this example, the mobile station is controlled by the home MSC. If the mobBe station has 
requested that calls be forwarded to another number, this wDI also be reported to the MSC for further proc- 
essing, either by the MSC If the call forwarding number is served by the home MSC, or for further processing 
by another MSC or the public switched telephone network. If the call forwarded number is not served by the 
home MSC. 

20 In this case, assume that the mobBe station has not requested call forwarding and is being served by the 
home MSC. The MSC determines the WSM which contains the VLR of the mobile station, which VLR is inte- 
grated in the MSC for this embodiment The MSC queries that VLR (action 2210). The VLR determines the 
most recent location area of the mobBe station, In order to have the mobile station paged by the BSSs In the 
most recent location area. The VLR responds with the Identity of the location area for performing the page 

26 (action 2212). 

The MSC then sends a message 2302 (FIG. 23) to the BSSs serving the location area requesting the page. 
The BSSs send out paging signals (action 2304) and the mobile station responds to this request (action 2306) 
via one of the BSS, with a request to assign a control channel to this mobile station. That BSS transmits to 
the mobile station a channel assignment 2308 for the dedicated control channel to be used. The mobile station 

x> tunes to that control channel and delivers its page response 231 0 over that control channel. 

Under the principles of the GSM standard for mobile communications, a mobile unit Is tuned to a single 
paging channel. If the mobile unit is turned on, It tunes to the paging channel of the base transceiver station 
with the strongest signal. This is done by taking signal strength measurements of the broadcast channels of 
several nearby base transceiver stations and selecting t he system with the strongest signal. The mobile station 

36 then tunes to the common control channel, paging subchannel of that system. If a mobBe unit has moved across 
location area boundaries while the mobile station Is powered on but not in the connected state, then the mobile 
station will send a location update message to the MSC which is used to update the VLR for that mobile station. 
The mobile station recognizes this transition because its internal record of a location area differs from the lo- 
cation area signal received from the base transceiver station via the broadcast control channel. 

40 When e mobile is originally paged, it is paged by all the transceiver stations In the location area where the 
MS has last registered. This paging message Is transmitted from the protocol handlers of the wireless global 
switching module to all the appropriate base station controllers. Within the WGSM, e paging request message 
received from a switching module contains the location area Identifier (LAI). This is translated to derive a series 
of point codes for the BSSs that contain Base Transceiver Stations which must broadcast the page. The PH 

45 that received the paging request message from the switching module broadcasts a message to the WGSM 
protocol handlers that also Includes the Identity of the mobile (the IMSI or TMSI as discussed hereinafter with 
respect to the authentication procedure), the point codes and a single logical route, effectively appended to 
each point code. The logical route Is a four bit quantity used to spread the signaling traffic over the different 
signaling links to the BSSs. Each protocol handler examines the point codes and the logical route to see If it 

50 is Involved (I.e., serves a signaling link that Is used) In transmitting paging request messages. Each Involved 
protocol handler transmits a paging request message to each of these BSS controllers for which that protocol 
handler is the designated some of paging messages for the point code and logical route; this paging request 
message Includes a list of the BTSe In the LAI so that a BSS that Includes portions of two or more LAIs can 
transmit a paging request only to the base transceiver stations serving that LAI. In an alternative version, not 

55 covered by the present GSM specification, the LAI Is sent and the BSS translates to find the appropriate base 
transceiver station for paging. 

An alternate approach is to make a translation within the protocol handler that receives the paging request 
message from the switching module to determine which protocol handlers of the WGSM should receive a mul- 
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ticaat paging message that Includes the point codes of the BSSs and the logical route for those BSSs involved 
In the paging, plus a list of base transceiver stations. Each of the determined recipients of this multicast mes- 
sage then translates the point codes and logical route to see if it Is to transmit a paging message; If so It trans- 
mits the appropriate paging message. In this approach, the Initial translation to determine which protocol han- 

5 dlers may be Involved In the process of transmitting paging request messages to base station controllers is 
performed In the single protocol handler that Initially receives the paging request message. A disadvantage 
of this approach is that each of the protocol handlers that makes the Initial translation needs a table for storing 
the translation Information. The simpler translation of the preferred embodiment Is only from the LAI to point 
codes, a relatively static translation. The updating of protocol handlers to respond to trouble conditions only 

10 affects the tables of protocol handlers actually transmitting data to the BSSs. 

The page response 2310 received by one of the BSSs is returned (message 2312) to the mobile switching 
center, specifically, the WGSM. The WGSM then transmits a message 2314 to the wireless switching module 
which contains the VLR information for this mobile station to Initiate the authentication process If necessary. 
Previously, the VLR has received from the authentication via the HLR five sets of data used for authenticating 

t5 the Identity of the mobile station and for use as an encryption key. If the VLR has only one set left, then It 
obtains an additional set via the HLR from the authentication center, using messages 2402, 2404, 2406 and 
2408 (FIG. 24). The VLR-WSM communicates to the mobBe station an authentication request 2410 for It to 
perform algorithm calculation. The mobile station than communicates the result (message 2412) of the cal- 
culation to the VLR-WSM which compares the result with the authentication data It stores. 

20 The VLR then transmits an encipher command (message 2602, FIG. 25), If necessary, to the BSS which 
transmits, over the radio channel, a cipher mode command 2504 requesting the mobile station to enter the 
cipher mode. The mobile station responds with a cipher mode complete message 2506 to the BSS and the 
BSS reports to the switching module containing the VLR that the encipher process has been completed (mes- 
sage 2508). The original encipher command sent from the VLR to the BSS Includes the key for use in encW 

25 phering the signals transmitted between the mobBe station and the BSS. The mobile station had previously 
received information for deriving the key during the authentication process. 

If the telecommunications operator has specified that an equipment Identity check is required, the mobile 
switching center then requests (message 2602, FIG. 26) from the mobile station Its International mobile equip- 
ment identification (IMEl). The mobBe station responds with that Information (message 2604) and this infor- 

30 mation is checked (action 2608) in the equipment Identification register (EIR) data base also stored in the MSC 
for that mobDe. The check result Is returned (action 2808) from the EIR. The equipment validation is performed 
to insure that the mobile unit Is authorized to make calls. Calls are only completed If both the VLR and the 
EIR data indicate that the mobile is authorized to make and/or receive calls. 

Thereafter, the mobile switching center sets up a call connection to the mobile station. It tranamita a mea- 
ls sage 2702 (FIG. 27) Including a transaction Identification for all messages generated by the mobile station, 
respecting this call. The mobile station responds with a call confirm message 2704. The mobile switching con- 
tar then requests (message 2706) the base station to assign a traffic (i.e., voice or customer data) channel to 
this call. The BSS selects the radio frequency and channel and informs the mobile station (message 2708) of 
t he same so that the mobile station can tune to this frequency and channel. The mobile station does so, reports 

40 (message 271 0) that the channel assignment has been completed, which permits the BSS to report (message 
2712) to the mobile switching center that the traffic channel has been assigned. 

The mobile station responds to the previously received traffic channel assignment request by locally gen- 
erating an alerting signal to the subscriber. An ■alert* message 2802 (FIG. 28) is sent from the mobile station 
to the MSC to Inform the MSC that mobile station user Is being alerted. The mobile switching center transmits 

45 an audible tone to the caller (action 2804). When the called customer at the mobile station goes off hook, i.e., 
answers the call, the mobile station sends a connection indication 2806 to the mobBe switching center, which 
forwards that connection Indication to the far party (action 2808) and transmits a connection acknowledge 
message to the mobile station 2810. 

In order to detect the fraudulent condition wherein two or more mobile stations have the same identity, a 

so situation which should not occur and will occur only as a result of an attempt to fraudulently cause telecom- 
munications charges to be Incurred by the primary owner of that Identif icaUon, the following steps are taken. 

Each of a class of state transitions is examined to see if the particular state transition is likely, in view of 
prior state of the mobile station. Whenever a mobile station changee state to one of the specified states, the 
previous one of the specified states for that mobBe station is examined and If the transition Is unlkely, a record 

55 is made for the mobile telecommunications network administration. These records are an Indication of possible 
fraud. The state transitions to which are examined are the following: attached mobBe station, detached mobile 
station, page response, location update, service request, and cancel location (a message from an HLR to a 
VLR to Indicate that the mobile has moved outside the area served by the MSC, and therefore, the VLR). Un- 
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likely events Include the reception of an attach, when the mobile station Is already attached, a detach when 
the mobile station Is already detached, the receipt of multiple page responses for a single page request of one 
mobile, the receipt of a location update while another update procedure or connection procedure Is In progress; 
the receipt of a service request when a mobile station is detached, In a location update procedure, or during 

5 an attach or detach procedure; or a change location message received when a call is In progress. 

Whenever a state change is one that Is unlikely to occur, a peg count Is made of the state change. The 
frequency of the unusual occurrences is displayed at a mobile switching control center or the Operation and 
Maintenance Center (OMC) so that a fraudulent use of an Identification can be detected. If the count exceeds 
a threshold, a special message is displayed or printed. 

10 The authentication process will now be described. The authentication process Is Initiated as a result of a 
service request by the mobile station or following a successful page of a mobile station, but is performed prt- 
marily under the control of the VLR. According to t he wishes of the telecommunications operator, this authen- 
tication process may be performed every time a mobile station originates or a call Is terminated to a mobile 
station. In addition, If the administration of the mobile switching system so desires, the authentication may 

15 take place whenever a location Is updated for a mobile station that is in the power-on and Idle state. In addit ton, 
authentication may be performed when a mobile station registers by turning on its power. 

In the case of a request for service originated by a mobfle station, the mobile station sends a message to 
the mobile switching center recording one of the requests discussed above. This message includes the IMSI 
(Inter national Mobile Subscriber Identification) or a TMSI (Temporary Mobile Subscriber Identification). The 

20 choice of an IMSI or a TMSI as the primary identification mechanism Is made by the system operator. The 
IMSI Is a permanent number which is assigned to every mobile station. The TMSI is assigned to a mobfle station 
only after an authentication, and has only local significance, if this is the first authentication request or an 
authentication request which for some reason has failed and the system administration Is using TMSI identi- 
fication, then the backup IMSI Is used for the purpose of authenticating the customer and assigning a new 

25 TMSI. The source of data used In authentication is an authentication center which in the present system Is 
present in each mobile switching module of the MSC. This authentication center (AUC) does not store any data 
for each customer. The purpose of the authentication center Is to generate random numbers which are used 
In conjunction with data in the HLR to generate authentication data. Initially, at the time when a customer sub- 
scribes for service, that customer is assigned an initial key K,. This key and a random number (RAND) supplied 

30 from the authentication center are acted upon by a first algorithm (A3) to generate a secondary number, an 
authentication number, referred to as Signed Response (SRES), a result of manipulating the random number 
using the A3 algorithm. In addition, the random number and K, are acted upon by a second algorithm (A8) to 
generate an encryption key K* Values of RAND. SRES and Ko are requested from HLR as needed by the VLR. 
In the preferred embodiment of the invention, five sets of RAND/SRES/Kc are generated and stored in the VLR 

39 each time a set of calculations is made. 

When the authentication Is needed, the MSC sends the random number to the MS. The MS retrieves K, 
from its initialization memory (which may be Initialized at the time of the purchase of the mobile station) and 
calculates SRES and K«. from the random number and the K| using algorithms A3 and A8. It then stores the 
Ko In the main station and sends the SRES result to the mobile switching center. The mobile switching center 

40 verifies that the SRES value calculated by the mobile station matches the SRES value that has been stored 
in the VLR and was previously calculated. If the values match, this is a successful authentication and it is as- 
sumed that the two values of the key Ko as stored in the MSC/VLR and In the mobile station are identical. 

Note that with this arrangement, only the random number and SRES are transmitted over the air. The two 
independently generated values of the encryption key, Ko , each generated from the random number and each 

45 generated using a value of K, which Is also never transmitted through the air, are not transmitted over the air. 
Since a separate algorithm Is used for deriving Kc and SRES, the fact that SRES and RAND are transmitted 
over the air does not permit an interloper to discover Ko . 

In case authentication falls, if the system administration uses TMSI, then the IMSI is sent as a backup In 
case the TMSI for one reason or another became garbled. If anotherauthentteation using the IMSI is attempted 

so and if that authentication Is successful, a new TMSI Is sent and actions which are based on a successful au- 
thentication can be performed. If the system administration uses an IMSI and authentication faBs or if authen- 
tication falls following an IMSI backup of a TMSI, then all service except emergency service is normally denied 
to that mobile station. 

Note that both t he TMSI and the IMSI may be sent over the airwaves without compromising security since 
55 these values are useless if the K, corresponding to that IMSI Is not available to a potential interloper. 

Some administrations may choose not to perform an authentication on every call. If this is the case and 
an IMSI or TMSI has been Intercepted, then e fraudulent call may be made, or a can may be fraudulently re- 
ceived. However, If this Is a call on which authentication Is made in an administration which chooses to au- 
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thenticate some percentage of Its calls, then authentication will tail and the faBure of authentication la a warn- 
ing to the administration that the particular IMSI or TMSI has been compromised. 

Only a single pair of algorithms is normally used at any one time. It is possible for a system administration 
to vary between pairs of such algorithms but there are no plans at this time to assign two different mobiles 
5 different algorithm pairs. 

It Is to be understood that the above description Is only of one preferred embodiment of the Invention. Nu- 
merous other arrangements may be devised by one skilled in the art without departing from the scope of the 
Invention. The invention Is thus limited only as defined in the accompanying claims. 
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APPENDIX A 
ACRONYMS AND ABBREVIATIONS 



AUC Authentication Center 

AM Administrative Module 

BSC Base Station Controller 

BSS Base Station System 

BSSAP Base Station System Application Pan 

BSSOMAP BSS Operation Maintenance and Administration Part 

BSSMAP Base Station System Management Application Pan 

BTS Base Transceiver Station 

CM Communications Module 

DFI Digital Facility Interface 

DTAP Direct Transfer Application Pan 

EIR Equipment Identity Register 

GSM Global Systems for Mobile Communications 

ISDN Integrated Services Digital Network 

ISO International Standards Organization 

HLR Home Location Register 

IMEI International Mobile Equipment Identification 

IMSI International Mobile Subscriber Identification 

ISUP ISDN User Part 

LAI Location Area Identifier 

OMC Operations and Maintenance Center 

MAP Mobile Application Pan 

MS Mobile Station (personal communication station) 

MSC Mobile Switching Center 

MTP Message Transport Part 

PH Protocol Handler 

PSTN Public Switched Telephone Network 

PSTN GSM PSTN Global Switch Module 

PSU Packet Switching Unit 

RAND Random Number 
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SCCP 


Signaling Connection Control Pan 


SIM 


Subscriber Identity Module 


SM 


Switching Module 


SMG 


Special Mobile Group 


SMP 


Switching Module Processor 


SRES 


Signed Response 


SS7 


Signaling System 7 


TC 


Transaction Capabilities 


TCAP 


Transaction Capabilities Application Part 


TMSI 


Temporary Mobile Subscriber Identification 


TSIU 


Time Slot Interchange Unit 


TUP 


Telephone User Part 


WGSM 


Wireless Global Switching Module 


WSM 


Wireless Switch Module 


VLR 


Visitor Location Register 



28 

Claims 

1. In a mobile telecommunications switch, a method of storing a Visitor Location Register (VLR) for a mobile 
station comprising: 

30 determining when the mobile station Is within the serving area of a Mobile Switching Center (MSC); 

and 

responsive to said determination, storing a VLR for that mobile station In a memory location of said 

MSC. 

35 2. The method of claim 1 further comprising: 

a9 said mobile station moves from one location area served by said MSC to another location area 
served by said MSC, retaining said VLR in said memory location. 

3. The method of claim 1 furt her comprising: 

40 maintaining a Temporary Mobile Subscriber Identification (TMSI) for said mobfle station while said 

mobile station is In an Idle, power on state, as said mobile moves from one location area to another location 
area served by said MSC. 

4. The method of claim 1 wherein if a particular VLR is stored In the same MSC as a Home Location Register 
(HLR) of a mobile station, said particular VLR is stored in association with said HLR so that common data 

45 is not duplicated within a basic VLR/HLR combined record. 

5. The method of claim 1 wherein said MSC Is modular and wherein a Temporary MobBe Subscriber Iden- 
tification (TMSI) comprises a subf teld for identifying a module of said MSC for storing said VLR. 

50 e. In a cellular mobfle telecommunications network, apparatus for storing and accessing visitor location reg- 
ister data comprising: 

a plurality of switching modules in said mobile switching center, each module for storing a subset 
of VLR data stored In said mobile switching center and 

means for processing a VLR data request message to determine which module contains VLR data 
« requested In said message and for routing said message to said module. 

7. The apparatus of claim 6 wherein said means comprises a table to determine which module contains a 
VLR for an International Mobile Subscriber Identification (IMS!) specified in said data request message. 
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The apparatus of claim 6 wherein a module stores both the VLR and Home Location Register (HLR) for 
mobile stations which are in the coverage area of the MSG that stores the HLR 

The apparatus of dalm 8 wherein the common data of HLR and VLR In a module Is stored In common for 
the VLR and HLR. 
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